Questionable Log

[mcdougrs]

Hey everyone,

I was just going through my logs and such when I saw a file called lastlog

-r--------    1 root     root     19136220 Mar 20 09:42 lastlog

Its like 19 megs in size. Can some, hopefully running RH8.0, verify that you also have this log or if it normal? If I do a less on it, it comes up with

*$E>:0^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@^@
^@^@^@^@^@^@^@^@^@^@^

And it keeps going and going and going! Oh and there is another one called xferlog and there are xferlog.1.gz - xferlog.4.gz anyone seen these before? They seem to just be a gzipped xferlog but they are empty.

[pwrhouse]

I can't help you with what lastlog is because I didn't even notice it until I read this thread.

xferlog on the other hand I can handle. That is a log of all of the ftp transfers that have been made.
The xferlog.1.gz - xferlog.4.gz are just old xferlogs. You are probably running logrotate or some other log rotation program, I know I have mine set to rotate my logs every week on sundays.

Hopes this helps.

[Stix]

The lastlog file is normal. It contains historical login data for every user on the system (try the command "lastlog&quot. It also does not get rotated. Mine is listed as 18Mb and the file has been on every redhat box i've ever had.

Stix

[demian]

The lastlog is normal and you can view it with the lastlog command as Stix said. However, 19MB is way too much. True, the file doesn't get rotated but there's no need to rotate it because it only contains details about the last time a user logged in to the system and so old data is replaced with new data and the file shouldn't grow that large. On my system (debian sarge) it's a little more than 200Kb in size. And unless you've got thousands of users on your system I don't see an explanation on why it would grow like that.

What does the output of the lastlog command look like?

[Stix]

Hey Demian,

Interesting thing on my box (RH8) is that "ls -lh /var/log/lastlog" shows the size as 18MB but "du -h /var/log/lastlog" shows the size as only 52KB. Based on the actual output of lastlog on my system, I'm going with the 52KB size .

Stix

[mcdougrs]

WOW thanks guys for the info about lastlog. I did the output and it showed that root and mcdougrs is the only users that have ever logged in. Which is correct for one main reason root and mcdougrs are the only actual users that are on the system, the rest are just program users. That is wierd about the size thing though. my du -h shows this:

[root@thalia root]# du -h /var/log/lastlog
44K     /var/log/lastlog

Am I reading the ls output wrong? Have they started to output things in bits not bytes? Even if that was the case, how would 19136220 = 44K ? Oh well.

Thanx again folks,
Ryan